Openclaw cli: CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths (CVE-2026-31999)
Description
Openclaw CLI versions from 2026.2.26 up to but not including 2026.3.1 on Windows have a vulnerability in the ACPX wrapper resolution for .cmd/.bat files. The fallback to shell execution allowed the current working directory (cwd) to influence execution behavior, potentially compromising command execution integrity. This issue is fixed in version 2026.3.1 by enforcing explicit PATH/PATHEXT entrypoint resolution and strict fail-closed handling for unresolvable wrappers.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Openclaw CLI affects Windows ACPX paths where the resolution of .cmd and .bat wrappers could fall back to shell execution in a way that allowed the current working directory (cwd) to influence the execution behavior. This cwd influence could lead to loss of command execution integrity. The fix implemented in version 2026.3.1 changes wrapper resolution to prefer explicit PATH/PATHEXT entrypoint resolution and unwrapped Node/EXE execution, with strict fail-closed handling for cases where wrappers cannot be resolved.
Potential Impact
On affected versions, an attacker could manipulate the current working directory to alter the behavior of wrapper execution, potentially causing unintended command execution or integrity loss in command execution. This could undermine the reliability and security of command execution in the Openclaw CLI environment on Windows.
Mitigation Recommendations
A patch is available in Openclaw CLI version 2026.3.1 that addresses this vulnerability by improving wrapper resolution and enforcing strict fail-closed behavior. Users should upgrade to version 2026.3.1 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-31999
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245c112601ec6a3166c57
Added to database: 10/04/2026, 12:25:37 UTC
Last enriched: 10/04/2026, 13:06:35 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.